System and method for providing targeted advertising through traffic analysis in a network environment

ABSTRACT

An example method includes receiving packets associated with network traffic and identifying location information associated with an end user related to the network traffic. The method also includes extracting keywords from the network traffic, the keywords and the location information are used as a basis for rendering an advertisement on digital signage that is physically proximate to a current location of the end user. In other embodiments, the network traffic can be matched against access control lists, which are configured with Internet protocol (IP) addresses relating to search engines. Additionally, the network traffic can be classified based on fields in the packets, wherein the fields include a source Internet protocol (IP) address, a destination IP address, and a transmission control protocol (TCP) port. In more particular embodiments, the network traffic is hypertext transfer protocol (HTTP) requests originating from a handheld device operated by the end user.

TECHNICAL FIELD

This disclosure relates in general to the field of communications and,more particularly, to providing targeted advertising through trafficanalysis in a network environment.

BACKGROUND

Advertising architectures have grown increasingly complex incommunication environments. As advertising technologies increase insophistication, proper coordination and efficient management ofadvertising content becomes critical. Typically, advertisers seek todistribute advertising content from various locations. In manyinstances, such content is universally broadcast to entire groups ofpeople. The ability to properly manage advertising resources and,further, to efficiently deliver content presents a significant challengeto system designers, component manufacturers, advertising agencies,network owners/operators, and system administrators.

BRIEF DESCRIPTION OF THE DRAWINGS

To provide a more complete understanding of the present disclosure andfeatures and advantages thereof, reference is made to the followingdescription, taken in conjunction with the accompanying figures, whereinlike reference numerals represent like parts, in which:

FIG. 1 is a simplified block diagram of a communication system forproviding targeted advertising through traffic analysis in a networkenvironment in accordance with one embodiment of the present disclosure;

FIG. 2 is a simplified block diagram illustrating one potentialconfiguration associated with the communication system;

FIG. 3 is a simplified block diagram of another embodiment for providingtargeted advertising through traffic analysis in a network environment;and

FIG. 4 is a simplified flow diagram illustrating example operationsassociated with the communication system.

DETAILED DESCRIPTION OF EXAMPLE EMBODIMENTS

Overview

A method is provided in one example and includes receiving packetsassociated with network traffic and identifying location informationassociated with an end user related to the network traffic. The methodalso includes extracting keywords from the network traffic, the keywordsand the location information are used as a basis for rendering anadvertisement on digital signage that is physically proximate to acurrent location of the end user. In other embodiments, the networktraffic can be matched against access control lists, which areconfigured with Internet protocol (IP) addresses relating to searchengines.

In yet other embodiments, the network traffic can be classified based onfields in the packets, wherein the fields include a source Internetprotocol (IP) address, a destination IP address, and a transmissioncontrol protocol (TCP) port. In more particular embodiments, the networktraffic is hypertext transfer protocol (HTTP) requests originating froma handheld device operated by the end user, and demographic dataassociated with the end user is identified in the network traffic.

Example Embodiments

Turning to FIG. 1, FIG. 1 is a simplified block diagram of acommunication system 10 for providing advertising through trafficanalysis in a network environment. FIG. 1 includes an access switch 14,a set of networks 18, 22, and several digital signage elements 24 a-c.Additionally, FIG. 1 includes several end users 12 a-d, who areoperating different types of devices (e.g., a personal digital assistant(PDA), a tablet, smartphones, etc.). These devices are capable ofachieving wireless connectivity to a given network in order to performvarious internet activities such as initiating search queries,performing general web surfing, conducting media sessions, engaging inphone calls, etc. In one particular example, communication system 10 isassociated with a retail environment, where various shoppers are presentat a mall in which wireless connectivity can be achieved in any suitablemanner.

FIG. 1 also includes a number of wireless controllers 30 a-b and anumber of access points 36 a-c. Furthermore, communication system 10 canalso include a digital media player 40, a targeted advertising server42, a traffic analyzer 44, and a location server 46. FIG. 1 alsoincludes a number of servers 50, which can represent search providerssuch as Google.com, Yahoo.com, etc., as well as business entities thatmay be queried for information (e.g., www.movieshowtimes.com,www.apple.com, etc.). In this particular example, servers 50 include webservers relegated for traffic destined for various hostnames (e.g.,having various uniform resource locators (URLs) including Google.com,Yahoo.com, and movieshowtimes.com).

Communication system 10 may include a configuration capable oftransmission control protocol/internet protocol (TCP/IP) communicationsfor the transmission and/or reception of packets in a network.Communication system 10 may also operate in conjunction with a userdatagram protocol/IP (UDP/IP) or any other suitable protocol whereappropriate and based on particular needs. Communication system 10 maybe generally configured or arranged to represent a 2G, a 2.5G, a 3G, a3.5G, or a 4 G communication architecture applicable to a Global Systemfor Mobile (GSM) environment in accordance with a particular embodimentof the present disclosure. Communication system 10 may also beconfigured to operate with any version of any suitable GPRS tunnelingprotocol.

In one embodiment, communication system 10 is configured to enabletargeted advertising on digital signs by leveraging network equipment(e.g., access switch 14) to perform traffic analysis. For example, ashopping mall could have several video displays (i.e., digital signages24 a-c), which display advertisements for the consumers, who are presentin the mall. These displays can be connected to network 18, throughwhich they are controlled and managed (e.g., including dictating whichcontent should be delivered, for which length of time, operating on aparticular schedule, inclusive of animation, sound, video, multimedia,etc.). Communication system 10 can be configured to provide end userswith relevant advertisements in the context of their spatialsurroundings. Such relevant information can inform, influence, orotherwise affect the purchasing decisions of the end users.

Handheld devices such as iPhones, Google androids, Blackberrys,smartphones, etc., have the capability to connect to 802.11 wirelessnetworks. Consumers can use their devices to obtain different kinds ofinformation (product information, driving directions, restaurantlocation, etc.). In a mall, a consumer may be interested in identifyingthe stores having the best prices on a particular type of product orservice, or identifying particular eating options, or identifying movieshow times for nearby movie theaters.

Communication system 10 can intelligently evaluate this search activityin order to provide appropriate advertising. For example, as consumerssearch for specific types of information using their handhelds that maybe connected to an 802.11 wireless network, communication system 10 cananalyze their network traffic (e.g., search requests) and providerelevant advertisements/information on digital signages 24 a-c. Inoperation, network traffic (e.g., wireless 802.11 traffic) from aconsumer's handheld can be sent to a wireless controller, which isconfigured to convert this data into 802.3 data to be sent to accessswitch 14. Traffic could then be inspected at access switch 14, where anappropriate advertisement application could be used to deliveradvertisements based on end user's internet activity. The advertisementsbeing delivered to digital signages 24 a-c could be relevant to thestores, restaurants, theaters, etc. at the mall.

Moreover, certain embodiments of the present disclosure can allowadvertisements offered by search providers (e.g., Google, Yahoo, etc.)to take the advantage of the user's location, where relevantadvertisements can be rendered (e.g., for nearby businesses that existin the geographic vicinity of the end users). Hence, an end user'sphysical presence (particularly so in the context of the purchasingopportunities/retail stores, etc. in the mall) can be used to renderreal-time targeted advertisements to this consumer. Additionally,because the content providers for digital signages 24 a-c representbusiness entities provided locally in the mall, the advertisements aremore relevant, better directed, timely, and sensible. Logically, thistranslates into a greater probability that the relevant advertisementswould influence shopping decisions. In this general sense, theadvertisements are far more efficient than haphazardly renderingadvertisements to crowds in a mall at arbitrary times.

It should also be noted that inspecting traffic is not burdensome orintrusive for the consumers to which the advertisements are beingdirected. Furthermore, such a protocol does not change (or necessarilymanipulate) the content/web pages being delivered to end users 12 a-d.Moreover, unwelcomed advertisements are not inserted into the web pagesretrieved in response to the search query. This lack of web pagemanipulation could obviate the problems caused by injecting JavaScriptinto web pages that compromise security and stability issues forHypertext Transfer Protocol (HTTP) traffic, Hypertext Markup Language(HTML) data, etc. Instead, intelligent and targeted businessadvertisements are rendered on digital signages 24 a-c in the malls,where the users are theoretically making conscious buying decisions.

It should also be noted that the web-browsing activity of the users isnot necessarily tracked (e.g., using persistent cookies). In contrast,communication system 10 is interested in searches that consumers performwithin the vicinity of the mall. In one particular example,proximity-based advertising is ensured by targeting the user at thefirst hop in the network. For example, the position of access switch 14at the ‘first hop’ of the network allows for an immediate identificationof location information of the end user, compared to the contentdelivered by the search engines themselves. Hence, the architecture canidentify, or otherwise understand, the precise geographic location ofthe user. The location information can be used to display advertisementsof products or services available in the surrounding location of digitalsignages 24 a-c. Before turning to details associated with some of thesepotential operations, a brief discussion is provided about theinfrastructure of FIG. 1.

End users 12 a-d can be associated with clients, customers, or end userswishing to initiate a communication in communication system 10 via somenetwork. In one particular example, end users 12 a-d are simplyindividuals capable of generating network traffic. In more detailedexamples, end users 12 a-d can also be proximate (or soon to beproximate) to digital signages 24 a-c. In certain timing scenarios,communication system 10 has the intelligence to predict (e.g., presuminga certain walking speed, a certain level of human traffic amongstindividuals in a retail environment, a certain level of congestion in aretail environment, etc.) when end users 12 a-d would arrive at certainlocations at which digital signages 24 a-c are present.

The term ‘end user’ is inclusive of devices used to initiate acommunication, such as a computer, a personal digital assistant (PDA), alaptop or electronic notebook, a cellular telephone, an iPhone, aBlackberry, a smartphone, a tablet, an iPad, an IP phone, or any otherdevice, component, element, or object capable of initiating voice,audio, video, media, or data exchanges within communication system 10.End users 12 a-d may also be inclusive of a suitable interface to thehuman user, such as a microphone, a display, or a keyboard or otherterminal equipment. End users 12 a-d may also be any device that seeksto initiate a communication on behalf of another entity or element, suchas a program, a database, or any other component, device, element, orobject capable of initiating an exchange within communication system 10.Data, as used herein in this document, refers to any type of numeric,voice, video, media, or script data, or any type of source or objectcode, or any other suitable information in any appropriate format thatmay be communicated from one point to another.

Access switch 14 is an Ethernet switch capable of analyzing networktraffic flowing through a given network in accordance with oneembodiment of the present disclosure. [Note that as used herein in thisSpecification, the term ‘network traffic’ is meant to include Internettraffic, IP traffic, HTTP traffic, requests, search queries, packets, orany datagram associated with a network transmission.] Access switch 14may be, more generally, any network element that receives end user flowsassociated with a given network (e.g., for networks such as thoseillustrated in FIGS. 1 and 3). As used herein in this Specification, theterm ‘network element’ is meant to encompass routers, switches,gateways, bridges, loadbalancers, firewalls, servers, inline servicenodes, proxies, processors, modules, or any other suitable device,component, element, or object operable to exchange information in anetwork environment. The network element may include appropriateprocessors, memory elements, hardware and/or software to support (orotherwise execute) the activities associated with providing targetedadvertising based on traffic analysis, as outlined herein. Moreover, thenetwork element may include any suitable components, modules,interfaces, or objects that facilitate the operations thereof. This maybe inclusive of appropriate algorithms and communication protocols thatallow for the effective exchange of data or information. Additionaldetails associated with a possible internal structure of access switch14 are provided below with reference to FIG. 2.

Access points 36 a-c and wireless controllers 30 a-b are communicationinterfaces between end users 12 a-d and networks 18 and 22. Thecommunication interface provided by access points 36 a-c and wirelesscontrollers 30 a-b may allow data to be exchanged between end users 12a-d and any number of selected elements within communication system 10.Access points 36 a-c and wireless controllers 30 a-b may facilitate thedelivery of a request packet generated by end users 12 a-d and thereception of information sought by end users 12 a-d. Access points 36a-c and wireless controllers 30 a-b can be configured to tunnel,encrypt, decrypt, encapsulate, de-capsulate, secure (through anyappropriate security protocol or mechanism), convert (as betweenprotocols), NAT (network address translation), or otherwise process datapackets propagating between end users 12 a-d and access switch 14.Access points 36 a-c and wireless controllers 30 a-b represent only oneexample of possible communication interfaces between end users 12 a-dand access switch 14. Other suitable types of communication interfacesmay be used for any appropriate network design and these may be based onspecific communication architectures.

Networks 18 and 22 represent a series of points or nodes ofinterconnected communication paths for receiving and transmittingpackets of information that propagate through communication system 10.Networks 18 and 22 offers a communicative interface between end users 12a-d and access switch 14, and may be any local area network (LAN),Intranet, extranet, wireless local area network (WLAN), metropolitanarea network (MAN), wide area network (WAN), virtual private network(VPN), or any other appropriate architecture or system that facilitatescommunications in a network environment. Networks 18 and 22 mayimplement a UDP/IP connection and use a TCP/IP communication protocol inparticular embodiments of the present disclosure. However, networks 18and 22 may alternatively implement any other suitable communicationprotocol for transmitting and receiving data packets withincommunication system 10. Networks 18 and 22 may foster anycommunications involving services, content, video, voice, or data moregenerally, as it is exchanged between end users 12 a-d and variousnetwork elements.

Digital signages 24 a-c are electronic services that offer a display atwhich data can be rendered for the end user. Note that as used herein inthis Specification, the term ‘digital display’ is meant to connote anyelement that is capable of delivering image data (inclusive of text,audio, media, and video data) to an end user, who may be in proximitywith digital signages 24 a-c. This would necessarily be inclusive of anydisplay, electronic billboard, panel, plasma element, television,signage monitor, computer interface, wall for projection activities,screen, TelePresence devices (inclusive of TelePresence boards, panels,screens, surfaces, etc.) or any other suitable element that is capableof delivering/rendering/projecting such information. Note also that theterm ‘image data’ is meant to include any type of text, media, audio, orvideo (or audio-video) data applications (provided in any protocol orformat) that could operate in conjunction with digital signages 24 a-c.

Servers 50 can be associated with search engines (e.g., URLs) offeringresponse content or services to any end user, or any group of end users.For example, servers 50 could be any network element associated withwww.google.com, www.yahoo.com: both of which could offer responsecontent for incoming search queries. Alternatively, servers 50 can beany destination, location, or node that is sought to be accessed or usedby end users 12 a-d. Servers 50 may provide the requesteddata/service/content, or provide a portal, pathway, or gateway toanother location that includes the desired data. In other embodiments,servers 50 could simply be a data storage location or a processor thatcan store or deliver content or services to one or more end users 12a-d.

FIG. 2 is a simplified block diagram associated with one exampleinternal structure of access switch 14. Access switch 14 may beindicative of an aggregation point through which traffic can flow fromvarious access points. Multiple end users may be seeking to accessvarious search engines, where their search traffic may pass throughaccess switch 14. Access switch 14 may include access control lists(ACLs) 60, a net flow engine 70, a processor 80, and a memory element90. In one example implementation, access switch 14 of FIG. 2 implementsa NetFlow protocol (e.g., through net flow engine 70) for aggregating,analyzing, and/or otherwise collecting IP traffic information. Forexample, the NetFlow protocol can be used when exporting informationabout the collected traffic. Each network device can generate particularrecords, which can be exported from the network element (e.g., in userdatagram protocol (UDP), stream control transmission protocol (SCTP),etc.).

Before detailing the processing that occurs at access switch 14, it isimportant to note how a given ACL can be provisioned. In more generalterms, individual servers, switches, routers, etc. can have networkACLs. Access control lists can be configured to control/monitor bothinbound and outbound traffic. In a general sense, ACLs 50 representcommands used to filter packets on network elements (e.g., routers,switches, etc.) based on the source IP address of the packet, or on thedestination IP addresses.

In operation of one particular example, consider wireless traffic(originating from end user 12 b) being diverted from wireless controller30 a to access switch 14. Net flow engine 70 can be configured toclassify the traffic flowing through access switch 14 into flows basedon fields in the packet (source IP address, destination IP address, TCPport, etc.). By provisioning rules into net flow engine 70 (e.g., for IPaddresses of popular search destinations such as www.google.com,search.yahoo.com, etc.) access switch 14 can identify the initial HTTPrequests for these destinations. The initial packets commonly containthe user-requested search terms (or keywords) in the URL itself (i.e.,HTTP GET) or in the packet (i.e., HTTP POST). These keywords can beextracted from the packets and, subsequently, advertising contentrelevant to these keywords can be delivered on the digital signages.

For example, if shoppers searched for movie times for Harry Potter atthe Grand Century Shopping Mall, these keywords can be extracted, wherethe relevant advertising information can be rendered on digital signage24 b. Similarly, if shoppers searched for the best deals on cellularphones at Westgate Mall, the architecture can analyze these keywordsand, subsequently, display advertisements associated with businessesthat relate to these keywords (e.g., an AT&T store offering cellulartelephones, at an Apple store offering iPhones, etc.). The advertisementcan be rendered on digital signages close to the particular end usersthat initiated the search queries (e.g., digital signage 24 c).

In one implementation, access switch 14 includes software to achieve (orto foster) the traffic analysis operations, as outlined herein in thisdocument. Note that in one example, access switch 14 can have aninternal structure (e.g., with a processor, a memory element, etc.) tofacilitate some of the operations described herein. In otherembodiments, all of these traffic analysis features may be providedexternally to this element or included in some other network element toachieve this intended functionality. Alternatively, access switch 14includes this software (or reciprocating software) that can coordinatewith other elements in order to achieve the operations, as outlinedherein. In still other embodiments, a given network element (e.g.,access switch 14) may include any suitable algorithms, hardware,software, components, modules, interfaces, or objects that facilitatethe operations thereof.

In addition to illustrating one possible example internal structure ofaccess switch 14, FIG. 2 also includes a general flow associated with aparticular operational example. ACLs 50 can be provisioned forparticular search engines, as reflected by Step 1 of FIG. 2. ACLs 50 canbe systematically accessed in order to properly evaluate incoming searchtraffic emanating from a set of end users. In this particular example,an ACL has been installed for IP addresses associated with popularsearch engines (e.g., identify a match for (DestIP=<Google/Yahoo/AOL IP>Dest TCP=80)). Note that a particular port (e.g., port 80) has also beendesignated at this juncture. If packets match a particular ACL, thosepackets can be systematically analyzed (as described below) to identifyappropriate advertising, which targets the end user(s) that initiatedthe search query. Additionally, packets can be copied and sent out on aspecified interface in Step 1. The first few packets of the HTTP sessioncan include HTTP GET/POST requests with search keywords included in themin this particular example.

At Step 2, network traffic associated with a particular end user isreceived by access switch 14. In this particular example, a search isbeing performed for blue jeans manufactured by the GAP, where the enduser is using Google as his search engine. At Step 3 of FIG. 2, the enduser's Internet traffic is forwarded along to its appropriate nextdestination. Thus, the system is continuously receiving the Internettraffic (e.g., inclusive of possibly receiving a copy of this traffic)that is being sent to particular search engines (e.g., Google.com inthis particular instance). In one particular example, the packets fromthe search query can be captured by net flow engine 70, whichcommunicates (e.g., redirects) these packets to an interface for trafficanalyzer 44 to process. Hence, a copy of packets matching the ACLcriteria is transmitted from access switch 14 to an appropriateprocessing mechanism, as is illustrated by Step 4.

Note that in a NetFlow-based scenario, a number of advantages could beachieved. For example, while an ACL-based solution replicates thetraffic that takes place at the configured interface, a NetFlow-basedsolution has a capability to relay a specified number of packets foreach flow. Since search terms are typically sent across to the searchengine in the first few packets (e.g., HTTP GET/HTTP POST), the NetFlowscenario can significantly reduce the amount of packet replication tothe configured interface. This will improve scalability of a deployment.

Returning to the previous flow of FIG. 2, in this particular instance,traffic analyzer 44 can identify the search terms ‘GAP’ and ‘bluejeans.’ Concurrently, as this process is occurring, location server 46can relay the position of the end user that initiated the search query.Based on the user being present (e.g., at the local mall at whichdigital signage elements are resident), a determination can be made asto which advertising would be appropriate for this particular end userbased on the search query. Subsequently, suitable advertising can berendered on digital signage elements 24 a-c for this particular user toview. For example as this end user is walking through the mall, he wouldsee a GAP advertisement and, further, blue jeans being offered at theGAP.

It should also be noted that the keywords can be used to render relevantadvertising, but usage of the term ‘relevant’ in this Specification ismeant to include not only relevance in matching product and serviceofferings to keywords, but also relevance in a marketing context. Hence,relevance for the term ‘blue jean’ would not be strictly correlated toproducts or services that match the identical keyword ‘blue jean.’ Forexample, if a given end user generated a search query associated withblue jeans, that end user may see advertisements associated with bluejeans and, further, associated with belts, or shirts that may coordinatewell with blue jeans. Hence, ancillary product and service offerings canbe served to the end user via digital signage 24 a-c. Similarly, if agiven end user used more generic terminology (e.g., searched for‘desserts’), he may see rendered digital advertisements for restaurantsmore generally. Anticipating how the actual consumer buying decisionsmight be executed can be left up to marketers, and/or to thoseindividuals who have invested time and resources in order to identifyconsumer behavior, buying preferences, consumption patterns, etc.

Note that there can be many users searching for different items, wheredigital signages would be configured to cater to all shoppersuniversally. Hence, the architecture can employ a ranking system of thesearch keywords based on popularity and, subsequently, deliverappropriate content. Further, the architecture can also control thescreen real estate corresponding to the popularity of the searchkeywords. For example, a certain portion of the digital signage (e.g.,50%) may be relegated to the top keyword found in recent searches (e.g.,over a configurable time period). The remaining portions of the digitalsignage can be occupied by several other popular search terms, wherethese search terms can be spread out over the digital signage. Inanother example implementation, the top three keywords can trigger thatthe digital signage should render advertisements equally (in thirds)across the distributable space of the digital signage. Hence, one thirdof the digital signage could be associated with a movie trailer, while asecond third of the digital signage may be associated with Nike shoes,and a third portion of the digital signage could be advertising AppleiPhones. Thus, the present disclosure can accommodate a scalable use ofscreen real estate based on the popularity of the content. Any suitablepermutations of these possible apportionments or delegations ofadvertising space are clearly within the broad scope of the presentdisclosure.

In one particular example, data mining technologies can be employed toextract information about user demographics. In one particularimplementation, the search keywords can be used to identifydemographics. For example, a search query associated with high-heeledshoes and makeup would draw an inference that the end user is either afemale, or is shopping for a female such that advertisements directedtoward women (or products to be consumed by women) would be moreappropriate for the digital signage. Hence, this data mining helpsdeliver more relevant and targeted content on the digital signages.

In other instances, energy conservation can be achieved in monitoringnetwork traffic through access switch 14. Hence, a possible powersavings can be achieved through turning off digital signages in areas ofno internet activity. For example, when no traffic is present at accessswitch 14, video walls, digital signage displays, air-conditioningunits, lighting fixtures, etc. can be turned down (e.g., in ahibernating or sleep mode), dimmed, or turned off. The lack of trafficat access switch 14 would imply that no users are in the vicinity and,therefore, energy expenditures should be minimized. There could be anassumption that certain wireless traffic from users may systematicallybe propagating in the network (e.g., keep-alive traffic fromapplications such as Skype, etc.). However, factoring these applicationsout, energy conservation practices can still be executed for energyconsuming devices.

FIG. 3 is a simplified block diagram illustrating one possibleimplementation associated with communication system 10. A number ofsteps are provided in this particular illustration, where FIG. 4 furthertracks these operations in detail. FIG. 4 is a simplified flowchart 100illustrating one set of example steps associated with the architectureof FIG. 3. Note that because these figures are related, they arediscussed together. Turning to Step 1 of FIG. 3, end users 12 c-d canuse their smartphones to achieve some connectivity via access point 36c. As part of their session establishment, end users 12 c-d can beissued an IP address, where their location information can also bemaintained (e.g., at location server 46). For example, each end user 12c-d can be linked to a particular access point (e.g., access point 36c). This is reflected by step 110 of FIG. 4. End users 12 c-d can benavigating through a shopping environment (e.g., any type of retail orservices environment in which advertising could be applicable). As endusers 12 c-d initiate search queries (e.g., associated with retailpurchases, product offerings, movie times, etc.), that Internet trafficpasses through wireless controller 30 b, which directs this traffic toaccess switch 14 (as shown in Step 2). This is also depicted in step 120of FIG. 4.

Access switch 14 can forward on the Internet traffic associated with endusers 12 c-d, as depicted at Step 3 a. This is also depicted in step 130of FIG. 4. Note that this particular search traffic is characterized byIP addresses associated with particular search engines (e.g., particularweb servers), as well as this traffic being associated with HTTP. Hence,a given ACL that is provisioned within access switch 14 can match IPaddresses associated with search engines to identify if this traffic isrelevant for potential advertising targeted to end users 12 c-d. Thesearch traffic (e.g., HTTP requests) can be received (e.g., interceptedand copied) by access switch 14, where the search traffic is sent totraffic analyzer 44, as shown in Step 3 b. This is also depicted in step140 of FIG. 4. [Note that the term ‘receiving’ as used herein in thisSpecification can include (but is not limited to) activities associatedwith reception, obtaining, intercepting, collecting, or otherwise beinggiven some object in the network (e.g., packets).]

Location information can be subsequently retrieved by traffic analyzer44, where this access activity can include interfacing with locationserver 46 (as shown in Step 4). This may include traffic analyzer 44identifying an IP address within the search query such that the IPaddress can be correlated to particular end users 12 c-d by locationserver 46. This is illustrated by step 150 of FIG. 4. In addition,traffic analyzer 44 can evaluate the particular search traffic toidentify keywords in the searches initiated by the end users 12 c-d.Thus, at this juncture, traffic analyzer 44 has the location informationof end users 12 c-d and the keywords associated with the particularsearch requests that were initiated.

This information can be sent to targeted advertising server 42 in anyappropriate format (e.g., in a tuple configuration, and a proprietaryformat, etc.), as shown in Step 5. This is also illustrated in step 160of FIG. 4. Targeted advertising server 42 can employ any type ofprocessing or filtering in order to identify the most relevant contentassociated with these particular keywords and the user's location.Targeted advertising server 42 can send a targeted video advertisementto digital media player 40, as shown in Step 6. Digital media player 40may also request the precise digital signage to which the targetedadvertisement is being streamed. This is also illustrated by step 170 ofFIG. 4.

Note that, in particular embodiments, the location information of theuser can play a role in deciding the relevant content delivered. Forexample, if a user performs a search query for the keywords ‘deals onshoes’ from the third floor of a shopping mall, then the contentselection methodology should consider stores on the third floor of themall, and the nearby floors, which would be more relevant in comparisonto the stores that are geographically farther.

Digital media player 40 can subsequently communicate a targeted videoadvertisement stream to network 18, as shown in Step 7. This is alsoillustrated by step 180 of FIG. 4. For example, if the search query wereassociated with movie times, the targeted video advertisement streamcould render movie trailers on digital signage 24 b. Hence, anintelligent advertising distribution decision could be made toinfluence, inform, or otherwise affect purchasing decisions of end users12 c-d.

It should be noted that Steps 4-6 are based on particular infrastructureassociated with a given architecture. That infrastructure can bemodified, altered, or otherwise changed without departing from the broadteachings of the present disclosure. For example, traffic analyzer 44could be consolidated with access switch 14, or targeted advertisingserver 42 can be consolidated with digital media player 40. There isconsiderable flexibility in the tendered architectures, where any suchconsolidation may be based on particular communication needs.

Note that there is also value in offering the keyword information toother search services such as Google, Yahoo, etc. A simple communicationinvolving access switch 14 (or any other appropriate network element)can be used to accommodate such a feature. Additionally, access switch14 can also harvest (or otherwise receive) traffic that indicates howthe end users carried out their purchases after seeing the renderedadvertisements. Indeed, in such a deployment, traffic (of multipleusers) that passes through access points in the vicinity of the stores(that were advertised in the delivered targeted advertisements) afterthe content was played on the signage, could provide an indication ofthe effectiveness of the advertisement. In this general sense, theeffectiveness (i.e., efficiency metric) of the advertisement can bemeasured. Other components (e.g., proprietary elements, access switches,routers, etc.) can be used to identify (or infer) what occurred as aresult of the advertisement rendered on the digital signage.

Note that in certain example implementations, the traffic analysisfunctions outlined herein may be implemented by logic encoded in one ormore tangible media (e.g., embedded logic provided in an applicationspecific integrated circuit [ASIC], digital signal processor [DSP]instructions, software [potentially inclusive of object code and sourcecode] to be executed by a processor, or other similar machine, etc.). Insome of these instances, a memory element [as shown in FIG. 2] can storedata used for the operations described herein. This includes the memoryelement being able to store software, logic, code, or processorinstructions that are executed to carry out the activities described inthis Specification. A processor can execute any type of instructionsassociated with the data to achieve the operations detailed herein inthis Specification. In one example, the processor [as shown in FIG. 2]could transform an element or an article (e.g., data) from one state orthing to another state or thing. In another example, the activitiesoutlined herein may be implemented with fixed logic or programmablelogic (e.g., software/computer instructions executed by a processor) andthe elements identified herein could be some type of a programmableprocessor, programmable digital logic (e.g., a field programmable gatearray [FPGA], an erasable programmable read only memory (EPROM), anelectrically erasable programmable ROM (EEPROM)) or an ASIC thatincludes digital logic, software, code, electronic instructions, or anysuitable combination thereof.

In one example implementation, access switch 14 includes software inorder to achieve the traffic analysis functions outlined herein. Theseactivities can be facilitated by net flow engine 70, ACLs 60, processor80, etc. Access switch 14 can include memory elements for storinginformation to be used in achieving the intelligent traffic analysisoperations, as outlined herein. Additionally, each of these devices mayinclude a processor that can execute software or an algorithm to performthe traffic analysis activities, as discussed in this Specification.These devices may further keep information in any suitable memoryelement [random access memory (RAM), ROM, EPROM, EEPROM, ASIC, etc.],software, hardware, or in any other suitable component, device, element,or object where appropriate and based on particular needs. Any of thememory items discussed herein (e.g., database, table, cache, key, etc.)should be construed as being encompassed within the broad term ‘memoryelement.’ Similarly, any of the potential processing elements, modules,and machines described in this Specification should be construed asbeing encompassed within the broad term ‘processor.’ Each networkelement of FIG. 1 (e.g., access switch 14) can also include suitableinterfaces for receiving, transmitting, and/or otherwise communicatingdata or information in a network environment.

Note that with the example provided above, as well as numerous otherexamples provided herein, interaction may be described in terms of two,three, or four network elements. However, this has been done forpurposes of clarity and example only. In certain cases, it may be easierto describe one or more of the functionalities of a given set of flowsby only referencing a limited number of network elements. It should beappreciated that communication system 10 (and its teachings) are readilyscalable and can accommodate a large number of components, as well asmore complicated/sophisticated arrangements and configurations.Accordingly, the examples provided should not limit the scope or inhibitthe broad teachings of communication system 10 as potentially applied toa myriad of other architectures.

It is also important to note that the steps in the preceding flowdiagrams illustrate only some of the possible signaling scenarios andpatterns that may be executed by, or within, communication system 10.Some of these steps may be deleted or removed where appropriate, orthese steps may be modified or changed considerably without departingfrom the scope of the present disclosure. In addition, a number of theseoperations have been described as being executed concurrently with, orin parallel to, one or more additional operations. However, the timingof these operations may be altered considerably. The precedingoperational flows have been offered for purposes of example anddiscussion. Substantial flexibility is provided by communication system10 in that any suitable arrangements, chronologies, configurations, andtiming mechanisms may be provided without departing from the teachingsof the present disclosure.

Although the present disclosure has been described in detail withreference to particular arrangements and configurations, these exampleconfigurations and arrangements may be changed significantly withoutdeparting from the scope of the present disclosure. For example,although the present disclosure has been described with reference toparticular retail environments, communication system 10 may beapplicable to any system in which network traffic (e.g., inclusive ofsearch queries) can be evaluated in order to render relevant (ortargeted) information for a particular user group. This could apply tocorporate scenarios, where a certain group of people (e.g., involved insome training lecture, a continuing education seminar, etc.) areutilizing their computing devices to generate network traffic, which canbe used as a basis for rendering relevant information locally to theseend users. For example, if a speaker at a conference used the term ‘deeppacket inspection’ and the network traffic of the audience membersrevealed some searching for a definition associated with ‘deep packetinspection’ then local electronic displays could simply show adefinition of this terminology, or a link to an IEEE standard, etc.

Moreover, although communication system 10 has been illustrated withreference to particular elements and operations that facilitate thecommunication process, these elements and operations may be replaced byany suitable architecture or process that achieves the intendedfunctionality of communication system 10.

What is claimed is:
 1. A method, comprising: receiving, at a networkelement having a processor and a memory element, packets associated withnetwork traffic, wherein at least a portion of the packets includesearch terms entered by a user; identifying location informationassociated with a device related to the network traffic by analyzing thereceived packets, wherein the location information indicates that thedevice has entered a predetermined geographic vicinity; extractingkeywords from the search terms; selecting an advertisement that isrelated to the keywords and is related to at least one business that islocated in the geographic vicinity; and displaying the advertisement ondigital signage that is physically separate from the device but isproximate to a current geographic location of the device, wherein thecurrent geographic location of the device is at least partially based onthe location information.
 2. The method of claim 1, further comprising:evaluating whether the network traffic is associated with internetactivity initiated by the device; and copying at least some of thepackets for extracting the keywords.
 3. The method of claim 1, furthercomprising: classifying the network traffic based on fields in thepackets, wherein the fields include a source IP address, a destinationIP address, and a transmission control protocol (TCP) port.
 4. Themethod of claim 1, wherein the network traffic is hypertext transferprotocol (HTTP) requests originating from the device, wherein the deviceis operated by the user, and wherein demographic data associated withthe user is identified in the network traffic.
 5. The method of claim 1,further comprising: receiving additional network traffic at the networkelement; and identifying an efficiency metric for the advertisementbased, at least in part, on the received additional network traffic. 6.The method of claim 1, wherein a ranking system is used to determinepopularity associated with particular keywords in order to identify theadvertisement to be rendered on the digital signage.
 7. The method ofclaim 1, wherein a predetermined number of packets of the networktraffic that match data in an access control list are copied.
 8. Themethod of claim 1, wherein a popularity of particular keywords is usedto determine the position of a plurality of advertisements on thedigital signage.
 9. The method of claim 1, further comprising:identifying search engine traffic in the network traffic, wherein thesearch engine traffic is identified by matching uniform resourcelocators included in the network traffic against an access control listthat is configured with uniform resource locators of search engines, andwherein the keywords are extracted from the search engine traffic. 10.Logic encoded in one or more non-transitory media that includes code forexecution and when executed by a processor operable to performoperations comprising: receiving packets associated with networktraffic, wherein at least a portion of the packets include search termsentered by a user; identifying location information associated with adevice related to the network traffic by analyzing the received packets,wherein the location information indicates that the device has entered apredetermined geographic vicinity; extracting keywords from the searchterms; selecting an advertisement that is related to the keywords and isrelated to at least one business that is located in the geographicvicinity; and displaying the advertisement on digital signage that isphysically separate from the device but is proximate to a currentgeographic location of the device, wherein the current geographiclocation of the device is at least partially based on the locationinformation.
 11. The logic of claim 10, the operations furthercomprising: evaluating whether the network traffic is associated withinternet activity initiated by the device; and copying at least some ofthe packets for extracting the keywords.
 12. The logic of claim 10, theoperations further comprising: classifying the network traffic based onfields in the packets, wherein the fields include a source IP address, adestination IP address, and a transmission control protocol (TCP) port.13. The logic of claim 10, wherein additional network traffic isreceived at a network element in order to identify an efficiency metricfor the advertisement.
 14. The logic of claim 10, wherein a rankingsystem is used to determine popularity associated with particularkeywords in order to identify the advertisement to be rendered on thedigital signage.
 15. An apparatus, comprising: a memory elementconfigured to store data, a processor operable to execute instructionsassociated with the data, and a net flow engine, wherein the processor,the net flow engine, and the memory element cooperate in order to:receive packets associated with network traffic, wherein at least aportion of the packets include search terms entered by a user; identifylocation information associated with a device related to the networktraffic by analyzing the received packets, wherein the locationinformation indicates that the device has entered a predeterminedgeographic vicinity; extract keywords from the search terms; select anadvertisement that is related to the keywords and is related to at leastone business that is located in the geographic vicinity; and display theadvertisement on digital signage that is physically separate from thedevice but is proximate to a current geographic location of the device,wherein the current geographic location of the device is at leastpartially based on the location information.
 16. The apparatus of claim15, wherein the network traffic is evaluated to determine whether itincludes a search request initiated by the device, and wherein at leastsome of the packets are copied in order to extract the keywords.
 17. Theapparatus of claim 15, wherein the net flow engine is further configuredto: classify the network traffic based on fields in the packets, whereinthe fields include a source IP address, a destination IP address, and atransmission control protocol (TCP) port.
 18. The apparatus of claim 15,wherein the network traffic is hypertext transfer protocol (HTTP)requests originating from the device, wherein the device is operated bythe user, and wherein demographic data associated with the user isidentified in the network traffic.
 19. The apparatus of claim 15,wherein the net flow engine is further configured to: receive additionalnetwork traffic at a network element; and identify an efficiency metricfor the advertisement based, at least in part, on the receivedadditional network traffic.
 20. The apparatus of claim 15, wherein aranking system is used to determine popularity associated withparticular keywords in order to identify the advertisement to berendered on the digital signage.
 21. The apparatus of claim 15, whereinspace allocation on the digital signage are correlated to popularityassociated with specific content being rendered on the digital signage.22. The apparatus of claim 15, wherein power is reduced for the digitalsignage based on a level of internet activity.
 23. The apparatus ofclaim 15, wherein the apparatus is a network element configured toidentify the location information associated with the device.